Splunk Search

Multiple File Indicator

zoebanning
Path Finder

Hello Splunk Community, 

I have created a query to calculate the business date of the file which arrived to be loaded & the date/time it arrived, which outputs the following (dummy data used): 

FileBusiness DateArrival DateArrival Time
File A22-11-202106-12-20216.51
File B22-11-202106-12-20216.55
File B22-11-202106-12-20216.56

 

I want to create a new column which highlights if a file (with the same business date) arrived more than once on the same day. So for example the output would look like so: 

FileBusiness DateArrival DateArrival TimeCount 
File A22-11-202106-12-20216.511
File B22-11-202106-12-20216.552
File B22-11-202106-12-20216.562

 

Can anyone help improving my query to include this new column? 

Thanks, 

Zoe

Labels (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @zoebanning,

You can use eventstats command to calculate count.

<your_existing_query> | eventstats count as Count by File, "Arrival Date"

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @zoebanning,

You can use eventstats command to calculate count.

<your_existing_query> | eventstats count as Count by File, "Arrival Date"
0 Karma

zoebanning
Path Finder

This worked perfectly. Thank You 🙂 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...